Skip to content

For coding agents

A launch gate your coding agent can act on.

Choose your coding client to see its supported setup and evidence label. LyraShield documents 48 workflows; a recorded setup does not prove runtime acceptance. Read-only tools retrieve findings. Hosted writes require a browser-confirmed connection grant and checks at execution.

Find your coding client

Documented client workflows (48)

Search by client name. Use the pinned CLI installer only when the guide provides one; otherwise follow its manual setup. Restart the client and verify an authenticated read-only call. Marketplace listing and runtime acceptance remain separate evidence. Aider uses the standalone CLI or CI path; Pi uses its native MCP and OAuth setup.

Agent Plugin · 6

Config file setup · 21

Uses the agent's own CLI · 1

Shows values to paste · 20

Six-stage release loop

  1. 01

    Target

  2. 02

    Review

  3. 03

    Evidence

  4. 04

    Fix proposal

  5. 05

    Retest

  6. 06

    Report

Set up and authenticate

npx --yes lyrashield@0.2.14 login --oauth

This command starts local workspace OAuth. Use the pinned CLI installer when a client guide provides one; otherwise follow its manual MCP or native setup. The CLI installs shared skills only for clients with a documented skill path. Hosted OAuth starts inside supported clients, including Pi; Aider uses the standalone CLI or CI path. Restart the client and verify discovery with a read-only authenticated call.

  1. 1Choose a client workflow — use the matching integration guide and check its support label.
  2. 2Configure and authenticate — use the client's documented MCP or standalone path. Hosted OAuth runs in the client; local stdio uses the CLI credential store or an API key.
  3. 3Check activation — restart the client, inspect its discovered tools and rules and make a read-only call.
  4. 4Use scoped review tools — hosted writes require a browser-confirmed grant and execution-time checks. Read the safety model.

What an agent can and cannot do

  • Pi has built-in MCP and OAuth support. Follow the current Pi guide at /docs/integrations/pi; the CLI installer does not configure Pi's native MCP connection.
  • Read-only tools are available after workspace authentication.
  • Fixes are proposals for review, not automatic code changes or merges.
  • Hosted writes require a browser-confirmed connection grant and execution-time scope checks. Nondelegated callers receive connect_required; local stdio clients use local approval.
  • CLI config writes are available only for exact client contracts recorded by the installer. When a guide has no pinned install command, use its manual setup and preserve existing settings, comments where supported and symlinks.
  • A CLI preview, config entry or doctor result does not prove client discovery or authentication; restart the client and complete a read-only authenticated call.

Read the Agent Plugin guide or the Remote MCP docs for the full setup and safety model.

Start free trial